The vulnerability resides in MISP’s attribute creation endpoint. An authenticated user with permission to add attributes could specify a sharing_group_id without the required authorization check when the distribution value is not set to 4, allowing the user to attach an attribute to a sharing group they do not own. This provides an access‑control bypass that compromises the integrity of attribute sharing data and could expose or misuse restricted sharing group relationships.

The affected product is the MISP open‑source cyber‑threat‑intelligence platform. No specific version numbers are listed, so any deployment that has not applied the commit that fixes the authorization logic remains vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% shows a very low but non‑zero likelihood of exploitation, and the issue is not listed in CISA’s KEV catalog. The attack vector requires the attacker to have valid credentials for a user who can create attributes, a common condition in MISP environments. Once authenticated, the flaw can be exploited simply by submitting the sharing_group_id, resulting in unauthorized access to group metadata.